Malicious PDF — malware analysis report

Static analysis result for SHA-256 dbe6d151e6b2fd79…

MALICIOUS

PDF

35.7 KB Authoring application: QPDF
MD5: 3d7571772b770ca301d5406ab1737911 SHA-1: 1deee041cb4b06bf244a16aa752cedbdf394bd61 SHA-256: dbe6d151e6b2fd796b2fa7bd960124ec4d52b9ca245f97224f001a4934f69ba8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious redirection intent. The primary goal appears to be directing users to a network of linked PDF files hosted on various domains, likely as part of a link farm to obscure malicious activity or distribute further payloads.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://namlems.org/uploads/1/3/0/7/130739239/gumosewi.pdf
    • http://newbioconsulting.com/uploads/1/3/0/3/130312961/6903997.pdf
    • http://alanakolb.com/uploads/1/3/0/5/130551788/227266.pdf
    • http://amiraharmani.com/uploads/1/3/0/4/130483546/jemimozutakepubob.pdf
    • http://remote.supply/uploads/1/3/0/7/130739182/1b5e2a6c.pdf
    • http://ocwswwtp.com/uploads/1/3/0/5/130588459/736472.pdf
    • http://vanderreeproducties.com/uploads/1/3/0/3/130313177/1096182.pdf
    • http://getzoinked.com/uploads/1/3/0/8/130814292/pibepawuzazenuvoza.pdf
    • http://badgeyourclassroom.com/uploads/1/3/0/7/130775912/cfe3266086667e.pdf
    • http://kuerital.com/uploads/1/3/0/6/130621801/pobegovevel_fegukinofo_xotukokeg.pdf
    • http://moldaufamily.com/uploads/1/3/0/3/130324136/pevixevebaz_sidowab_bisupopilogiwi.pdf
    • http://poisepublishing.com/uploads/1/3/0/8/130873709/diviwuvanexinot.pdf
    • http://hoy.bz/uploads/1/3/0/6/130604307/f5d134.pdf
    • http://rawhidemotel.com/uploads/1/3/0/6/130621020/1990695.pdf
    • http://miralunacraniosacral.com/uploads/1/3/0/7/130739938/7543782.pdf
    • http://911bailbondsla.com/uploads/1/3/0/7/130776718/6729576.pdf
    • http://webmail.bardosdiamondsports.com/uploads/1/3/0/5/130550824/130550824.html#mendelian+genetics+word+problems

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f86.bin
8d20e351b1a0831fd40c622698c775e45ed86c9a2fcfec62bf35a786ecd84bf4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F86 8072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.